Why WooCommerce keeps releasing security updates, and what to do

Since the summer, WooCommerce store owners have seen a steady run of security updates: for WooCommerce itself, for WooCommerce Subscriptions, Stripe and WooPayments, and a PHP advisory on top. On 6 November 2026 WooCommerce published its own account of why. AI tools have made security flaws far easier to find, and WooCommerce has chosen to go looking for them itself. More updates are a sign of that work being done, not a sign your shop has become less safe. They do mean that keeping up matters more, especially going into the busiest trading weeks of the year.

We covered the most recent release, WooCommerce 11.2.2, in our 6 November post. This post looks at the bigger pattern and how to handle it.

Why the updates keep coming

WooCommerce’s post, written by Darren Ethier, puts it plainly: AI tools have made vulnerabilities (security flaws) much easier to find for everyone. Over the last year, reports about Woo products through Automattic’s HackerOne programme, a platform where outside researchers report flaws, rose roughly ninefold. Duplicate reports jumped too, which suggests many people are running similar AI tools over the same public code.

This is not unique to WooCommerce. The WordPress project launched a Core Security Initiative on 28 August 2026 because of a sharp rise in reports. In a 29 October update, the WordPress security team said its HackerOne programme used to receive 20 to 30 reports a month, but received 773 in August alone, and more than 3,000 so far this year. That is more than the previous twelve years combined.

Rather than wait for reports, WooCommerce has been scanning its own code:

• July: an AI-assisted review of a full year of releases caught every high-severity issue already known.
• August: deep scans of WooCommerce and its own extensions flagged roughly 700 possible issues, each checked by hand.
• Since August: every code change merged into WooCommerce core gets an automated AI security scan. This has raised 34 issues, 18 of them confirmed.
• October: WooCommerce joined Anthropic’s OSS Scanner programme, which flagged roughly 200 findings. About 90% of those in the core software were confirmed, and the fixes are shipping in 11.2.2 and the upcoming 11.3.1.

AI does a first pass on incoming reports within minutes, but people decide how serious each issue is, review every fix and approve every release. WooCommerce says security currently takes priority over everything else, so some planned features have been delayed.

Why this is reassuring rather than worrying

WooCommerce’s own scanning has found more than twice as many confirmed core issues as outside reports have. In other words, it is increasingly finding problems before anyone else does, which is what you want from the people who maintain your shop’s software.

Most of what is being fixed is not dramatic. About three quarters of the confirmed issues in WooCommerce core since July are rated Medium or Low severity, meaning they need specific conditions to work or do little harm if they do. That figure covers WooCommerce core only, not extensions.

On whether anything has been attacked, the honest answer is that WooCommerce has said little either way. The Subscriptions notice says there is no evidence any store was compromised, and the Stripe notice says there is no evidence of real-world attacks. The 11.2.2 and WooPayments notices don’t say. No public reference numbers or severity scores have been published for these. Finding flaws quickly also means the details become easier for others to work out once fixes are public, which is why applying updates promptly still matters.

How fixes now arrive

WooCommerce has changed how security fixes are delivered. They now get their own releases by default, separate from new features:

• Critical and High severity fixes go in the next patch release of the current version.
• Medium and Low severity fixes go in the patch release after the next feature (minor) version.

The reason is practical. When security fixes travelled with feature releases, rolling back an update that broke something also removed the security fixes. WooCommerce describes the aim as “smaller, predictable updates you can apply quickly, separate from new features”.

11.2.2 was the first release under this approach. WooCommerce 11.3.0, a feature release, is due on 10 November 2026, and 11.3.1 will follow with the next set of security fixes. No date has been given for 11.3.1 yet.

Two other changes are worth knowing about:

• Older versions get very little. Only the most severe fixes (9 or higher on CVSS, the standard 0–10 severity score) are backported to older versions. Everything else ships in the latest release only. Staying on an old version means missing most fixes.
• Paid extensions can now update themselves for security. From WooCommerce 11.2, WooCommerce.com can mark an extension’s security release as required. Stores connected to WooCommerce.com with an active subscription for that extension will install it at the next update check, usually within a day, even with auto-updates off. It is only used for security fixes, it can take longer than a day, and sites set up to block automatic updates won’t receive it. WooCommerce’s example is a Subscriptions flaw it fixed in August with no way to get the fix onto stores that don’t update themselves. WooPayments and Stripe come mainly through WordPress.org, which WooCommerce says has a similar mechanism, though it isn’t clear this applies in every case.

What you should do

If we look after your website

These updates are part of our care work, so there is nothing you need to do. If you have staging or development copies of your site that are publicly accessible, or extensions bought outside our setup, let us know so they are included too.

If you manage it yourself

WooCommerce’s own checklist is sensible and short:

• Keep WooCommerce, extensions and WordPress up to date.
• After a security update, check the installed version, even if auto-updates are on.
• Buy extensions through the WooCommerce Marketplace, stay connected to WooCommerce.com and keep subscriptions active, so required security updates can reach you.
• Check your PHP version under Tools > Site Health > Info > Server, or WooCommerce > Status > Server environment.
• Check every site, including publicly accessible staging and development copies.
• Test upcoming versions before release so a patch causes no surprises.

On PHP, the programming language your server runs: versions before 8.2 no longer receive security updates, and WooCommerce recommends 8.3 or newer. WooCommerce 11.3 will show a notice to stores on PHP 7.4 or 8.0, and WooCommerce 11.6, planned for February 2027, will require at least 8.1. That change was moved to give stores time after peak season. Treat 8.1 as the bare minimum and 8.3 as the real target, and test any PHP change on a staging copy first, checking checkout, payments, shipping and tax. We explained why server-level flaws need your host rather than a WordPress update in our post on the PHP and Brotli flaws.

A note on peak season

WooCommerce hasn’t given timing advice for Black Friday, so this is our own view. Many shops hold back changes during their busiest weeks, which is reasonable for new features and design work. Security patches are different: they are now small and separate precisely so you can apply them quickly. Because Medium and Low fixes will land in 11.3.1 rather than as patches to 11.2, it is worth testing 11.3.0 on a staging copy soon after it comes out, so you are ready to move when 11.3.1 arrives rather than deciding in the middle of your busiest week.

If you would rather not keep track of all this yourself, our care plans cover updates, testing and version checks across live and staging sites.